untrack sample .env files, add .env.example placeholders

Live .env files (with real OAuth secrets) were tracked. Replaced with .env.example
templates. Existing .env files kept on disk so the sample still runs.

NOTE: prior history (8c5deb7, 88c2860) on gitea/main still contains the leaked
GOOGLE_CLIENT_SECRET. Rotate the credential in Google Cloud Console and decide
whether to rewrite history.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cfg/.gitignore

@@ -1,6 +1,5 @@
 # Environment files with credentials (use .env.example as template)
 **/.env
-!sample/**/.env
 
 # Database dumps (sensitive data)
 **/dumps/*.sql